Pattern for secure store

ABSTRACT

A computer system, computer product, and method for accessing a secure store, which includes receiving a request to access a secure store, checking the file path of the request to make sure it exists in the secure store, verifying security parameters from the process at the file system filter layer, saving the PID of the process by the file system filter layer, comparing the saved PID to the process&#39;s PID, and allowing the process to access the path in the secure store specified in the request.

FIELD OF INVENTION

The present invention provides a secure system and method fordetermining whether an item is warranty-eligible.

BACKGROUND OF INVENTION

Companies, including manufacturers and vendors of products, warrantytheir products, including but not limited to hardware and softwarecomponents. The warranties for products are often handled by an“after-sales” department, such as customer support. When a productrequires replacement or maintenance, the validity of the warrantydetermines whether the expense is covered by the guarantor of thewarranty. To determine whether a product is under warranty, it is notenough to track only the warranty period, for example, by correlatingthe warranty number to its validity period. However, many products,including but not limited to, hardware components, have maximum usagenumbers that contribute to whether an item is covered under a warranty.If the maximum usage has been exceeded, a unit may not be covered.

Although a warranty number is public, the maximum usage number is oftenconfidential so that a user cannot access it and manipulate it.

A need therefore exists for a system and method of storing confidentialwarranty-related information, including but not limited to, the maximumusage number for a given component.

SUMMARY OF INVENTION

An object of the present invention is to provide a secure system andmethod for determining whether an item is warranty-eligible.

In an embodiment of the present information, warranty information,including but not limited to the maximum usage number and the warrantynumber and term, is protected in a secure store. This security store isqueried by an application executed on a processor, which satisfies thesecurity credentials of the server housing the security store.

In an embodiment of the present invention, the security credentials arenot known to the user of an application that checks confidential data inthe secure store. Disseminating security credentials beyond authorizedpersonnel represents a security risk. Further, the security credentialsare not entered by the user, even an authorized user, and in anembodiment of the present invention, embedded in the application itselfthat accesses the secure store.

In a further embodiment of the present invention, the license key isembedded in the device manufacture data. The application accesses thelicense key from the manufacture data via a private interface. Thelicense key is then encrypted to security parameters by a mathematicalalgorithm familiar to one of skill in the art, including but not limitedto SHA, MDS, and/or CRC. When the encrypted security parameters arepassed to the file system layer, they are decrypted to the license keyusing the same algorithm(s). Thus, in this embodiment, at both thelicense key and the mathematical algorithm are needed in order to accessto pass through this level of verification to the secure store.

Additionally, in an embodiment of the present invention, the ability fora user to unmount or format the secure partition where the secure storeis housed, is disabled from the user perspective. Disabling thisfunctionality enhances security because the uninterrupted and unchangedconnection to the secure partition enables the processor on the clientmaking this connection to log all activity because this partition willbe continuously “watched” by the system.

In an embodiment of the present invention, because the secure partitioncannot be unmounted or formatted by a user, for the purposes of in-housemaintenance, the partition can be formatted through a developer'sbootload. Thus, for example, if the secure partition becomes corruptedand must be formatted to restore the integrity of the data, a developercan modify the partition can modify the partition via the bootloaderwhen the operating system is launched.

In an embodiment of the present invention, the secure store is accessedby an application that is verified both by the security parameters thatit passes the file system filter, and by the PID assigned to theapplication (program). In an embodiment of the present invention, thisapplication encrypts the license key embedded in the device manufacturedata and this encrypted value comprises the security parameters that arepassed to the file system filter. At this level, the security parametersare decrypted to access the license key, which is verified by the filesystem filter.

In an embodiment of the present invention, the application, the program,that accesses the security store is comprised of computer-readable codeand is executed on a processor on a client. The computer code is storedon one or more memory resources that are/is accessible to the clientprocessor. The location of the resource(s) can be internal and/orexternal to the client.

In an embodiment of the present invention, before accessing the storeddata in the secure store, the application, i.e., the program, initiatesa security process. First, the security parameters passed by the programare verified by a file system filter layer on the secure partition. Ifthe parameters pass the verification by the file system filter layer onthis file system level, the file system filter layer saves theapplication's process identification (PID).

In an embodiment of the present invention, when the application, theoriginating program, after completion of the security sub-program,requests access to confidential information, including the warrantyinformation in the secure store, the file system filter layer firstchecks that the PID has been saved. The application can continue if andonly if the PID is saved. Otherwise, the information request isrejected. This originating program cannot run without a PID.

In an embodiment of the present invention, once the originating programaccesses the security store, the program terminates. If the applicationseeks to access the security store at another point, the securitysub-process (verification of the security parameters in the program andlogging of the program's PID and additional security check for thelogged PID, must complete before the originating program can access thesecurity store.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 depicts a technical architecture of an embodiment the presentinvention.

FIG. 2 depicts an aspect of an embodiment the present invention.

FIG. 3 depicts an aspect of an embodiment the present invention.

FIG. 4 depicts a workflow of an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

The present invention provides a secure system and method fordetermining whether an item is warranty-eligible.

The present invention offers a tiered security approach to protectinginformation, including but not limited to, information regarding whethera warranty for a product is still valid, such as the usage informationand warranty number and term. An application utilizing a traditionalapplication programming interface (API) to access the secure storehousing this information could present a security risk. A traditionalAPI passes security parameters to access secure information and theseparameters are entered by a user. Giving security parameters to a useradds a level of exposure to the secure store. Thus, as discussed later,in an embodiment of the present invention, the security parameters areembedded in an application. In an embodiment of the present invention,this security measure is not the only security measure the programpasses to gain access to the secure store.

In an embodiment of the present invention, the interactions of the userwith the system are further limited by disabling the ability of the userto format or dismount the secure partition that houses the securitystore. In fact, the partition cannot be dismounted or formatted from theapplication level. Limiting this access has at least two advantages: 1)the data in the secure store is further protected; and 2) the computersystem upon which the secure store is mounted can accurately monitor andlog the activity in the secure store. When a partition is unmounted, theclient that later mounts the partition is unaware of the activitieswithin the partition during the time that the partition was unmounted.This knowledge gap compromises the security of the system in cases wherethe secure partition is hacked when it is unmounted and the data and/orits integrity is compromised.

In an embodiment of the present invention, because the secure partitioncannot be unmounted or formatted by a user, for the purposes of in-housemaintenance, the partition can be formatted through a developer'sbootload. Thus, for example, if the secure partition becomes corruptedand must be formatted to restore the integrity of the data, a developercan modify the partition can modify the partition via the bootloaderwhen the operating system is launched.

FIG. 1 depicts a technical architecture of an embodiment of the presentinvention. In this embodiment 100, the secure partition where the securestore is location is represented by a server 110. However, the securepartition is not limited to a single machine and can also be a partitionof the same computer that executed the program that queries the securestore.

A client 120 executes a program to connect to the secure partition onserver 110. In FIG. 1, the network connection 130 between the server 110and the client 120 is accomplished via a LAN. However, the client 120can connect to the server 110 using any connection known to one of skillin the art, including but not limited to, a WAN, a VPN, a private framerelay, and/or the Internet.

FIG. 2 illustrates a block diagram of a client, a computer system 120,which is part of the technical architecture of certain embodiments ofthe present invention. (An embodiment of the server 110, also a computersystem, is illustrated in FIG. 2.) The system 120 may include acircuitry 202 that may in certain embodiments include a microprocessor204. The computer system 200 may also include a memory 206 (e.g., avolatile memory device), and storage 208. The storage 208 may include anon-volatile memory device (e.g., EEPROM, ROM, PROM, RAM, DRAM, SRAM,flash, firmware, programmable logic, etc.), magnetic disk drive, opticaldisk drive, tape drive, etc. The storage 208 may comprise an internalstorage device, an attached storage device and/or a network accessiblestorage device. The system 200 may include a program logic 210 includingcode 212 that may be loaded into the memory 206 and executed by themicroprocessor 204 or circuitry 202.

In certain embodiments, the program logic 210 including code 212 may bestored in the storage 208. In certain other embodiments, the programlogic 210 may be implemented in the circuitry 202. Therefore, while FIG.2 shows the program logic 210 separately from the other elements, theprogram logic 210 may be implemented in the memory 206 and/or thecircuitry 202.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system”.Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readable signalmedium may include a propagated data signal with computer readableprogram code embodied therein, for example, in baseband or as part of acarrier wave. Such a propagated signal may take any of a variety offorms, including, but not limited to, electro-magnetic, optical or anysuitable combination thereof. A computer readable signal medium may beany computer readable medium that is not a computer readable storagemedium and that can communicate, propagate, or transport a program foruse by or in connection with an instruction execution system, apparatusor device.

A computer readable storage medium may be, for example, but not limitedto, an electronic, magnetic, optical, electromagnetic, infrared orsemiconductor system, apparatus, or device, or any suitable combinationof the foregoing. More specific examples (a non-exhaustive list) of thecomputer readable storage medium include the following: an electricalconnection having one or more wires, a portable computer diskette, ahard disk, a random access memory (RAM), a read-only memory (ROM), anerasable programmable read-only memory (EPROM or Flash memory), anoptical fiber, a portable compact disc read-only memory (CD-ROM), anoptical storage device, a magnetic storage device, or any suitablecombination of the foregoing. In the context of this document, acomputer readable storage medium may be any tangible medium that cancontain or store a program for use by or in connection with aninstruction execution system, apparatus, or device.

Using the processing resources of a client 120 to execute software,computer-readable code or instructions, does not limit where this codeis can be stored. Referring to FIG. 3, in one example, a computerprogram product 300 includes, for instance, one or more non-transitorycomputer readable storage media 302 to store computer readable programcode means or logic 304 thereon to provide and facilitate one or moreaspects of the present invention.

Program code embodied on a computer readable medium may be transmittedusing an appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programminglanguage, such as Java, Smalltalk, C++ or the like, and conventionalprocedural programming languages, such as the “C” programming language,assembler or similar programming languages.

The program code may execute entirely on one resource, such as theserver 110, the client 120, or partly on various resources.

One or more aspects of the present invention are described herein withreference to flowchart illustrations and/or block diagrams of methods,apparatus (systems) and computer program products according toembodiments of the invention. It will be understood that each block ofthe flowchart illustrations and/or block diagrams, and combinations ofblocks in the flowchart illustrations and/or block diagrams, can beimplemented by computer program instructions. These computer programinstructions may be provided to a processor of a general purposecomputer, special purpose computer, or other programmable dataprocessing apparatus to produce a machine, such that the instructions,which execute via the processor of the computer or other programmabledata processing apparatus, create means for implementing thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

The flowcharts and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

In addition to the above, one or more aspects of the present inventionmay be provided, offered, deployed, managed, serviced, etc. by a serviceprovider who offers management of customer environments. For instance,the service provider can create, maintain, support, etc. computer codeand/or a computer infrastructure that performs one or more aspects ofthe present invention for one or more customers. In return, the serviceprovider may receive payment from the customer under a subscriptionand/or fee agreement, as examples. Additionally or alternatively, theservice provider may receive payment from the sale of advertisingcontent to one or more third parties.

In one aspect of the present invention, an application may be deployedfor performing one or more aspects of the present invention. As oneexample, the deploying of an application comprises providing computerinfrastructure operable to perform one or more aspects of the presentinvention.

As a further aspect of the present invention, a computing infrastructuremay be deployed comprising integrating computer readable code into acomputing system, in which the code in combination with the computingsystem is capable of performing one or more aspects of the presentinvention.

As yet a further aspect of the present invention, a process forintegrating computing infrastructure comprising integrating computerreadable code into a computer system may be provided. The computersystem comprises a computer readable medium, in which the computermedium comprises one or more aspects of the present invention. The codein combination with the computer system is capable of performing one ormore aspects of the present invention.

Further, a data processing system suitable for storing and/or executingprogram code is usable that includes at least one processor coupleddirectly or indirectly to memory elements through a system bus. Thememory elements include, for instance, local memory employed duringactual execution of the program code, bulk storage, and cache memorywhich provide temporary storage of at least some program code in orderto reduce the number of times code must be retrieved from bulk storageduring execution.

Input/Output or I/O devices (including, but not limited to, keyboards,displays, pointing devices, DASD, tape, CDs, DVDs, thumb drives andother memory media, etc.) can be coupled to the system either directlyor through intervening I/O controllers. Network adapters may also becoupled to the system to enable the data processing system to becomecoupled to other data processing systems or remote printers or storagedevices through intervening private or public networks. Modems, cablemodems, and Ethernet cards are just a few of the available types ofnetwork adapters.

Although the architectures depicted in FIGS. 1-2 are non-limitingexamples, for ease of understanding only, these figures are referencedthroughout FIG. 4, a workflow 400 of an embodiment of the presentinvention.

To initiate the query process, the client 120 executes a program(application). The program is initiated (S410) and executes on a client120 processor and is comprised of computer-readable code. The computercode is stored on one or more memory resources that are/is accessible tothe client 120 processor. The location of the resource(s) can beinternal and/or external to the client 120.

First, the program registers on the file system layer and the securityparameters are passed to the file system filter layer (S415). Once thesecurity parameters are passed to the file system filter layer attemptsto verify the passed security parameters (S420).

If these parameters are verified by the file system filter layer, thePID of the program is saved (S430 a) on a memory resource in thephysical machine where the file system filter layer resides and/or on amemory resource that is accessible to the file system filter layer via acommunications connection. If the security parameters are incorrect orabsent, the application fails to register at the file system filterlayer (S430 b).

An application may attempt to bypass the security at the file systemfilter layer and directly access the security store. Such an applicationis seen in FIG. 4 (S430 c). This application did not register at thefile system filter layer (S415) and did not pass security parametersthat were verified (S415). This application is included in FIG. 4 todemonstrate the operation of the security features of the embodimentwhen an application fails to clear the security at the file systemfilter level before attempting to access the secure store.

The registration of the application to the file system filter layer maybe handled as part of the security routine or as part of a subroutine.One of skill in the art will recognize that the use of a sub-routine toaccomplish tasks that feed into the master routine is just a programmingpreference. Further embodiments of the present invention incorporate thesecurity check by the file system filter layer into a single programmingroutine, and/or use a separate routine. FIG. 4 is shows some steps as apart of the same routine that can be separated into sub-routines infurther embodiments just for the sake of clarifying the differentsecurity measures involved in accessing the secure store. Additionally,the check for a logged PID, which is discussed later, is represented asa subroutine in this embodiment. However, one of skill is the art willrecognize that this is one of many potential programming choices instructuring this workflow.

In an embodiment of the present invention, the security parameters arean encrypted license key. This license key is embedded in the devicemanufacture data, for example, for a hardware component. The programaccesses the embedded data to retrieve the license key via a secureconnection, including but not limited to, a private interface created bythe executed computer code, the application. After the license key isretrieved, it is encrypted by a mathematical algorithm. Variousmathematical encryption algorithms are known to one of skill in the artand can be employed by this process. Encryption algorithms that can beused to encrypt the license key include but are not limited to SHA, MDS,and/or CDC.

When the security parameters comprise an encrypted license key, the filesystem filter layer decrypts the security parameters to verify thelicense key. For decryption, the same algorithm that was used inencryption is employed. In this embodiment, only a program with both thecorrect encryption algorithm and the license can gain access to thesecure store.

Returning to FIG. 4, after logging the PID (S430 a), the programattempts to access (read/write) a file in the secure store (S440). Theapplication that failed to register (S430 b), and the application thatbypassed registration (S430 c) also attempts to access a file in thesecure store (S440). First, the path of the file is checked to see ifthe file is in the secure store (S450). If the path is to the securestore, a security subroutine is executed (S460 a) to check the PID ofthe application against the PID stored by the file system filter layer(S470 a). The subroutine checks whether the PID of the applicationmatches the stored PID (S480 a). If the PIDs match, the query, forexample, to retrieve warranty information, is given access to the securestore (S490 a) and the program runtime executes (S495 a). After theruntime is complete, the program terminates (S499 b). Once the securestore's warranty information is retrieved by an application that passesthe security, in order to complete a new query, the same securityroutine 400 repeats. Each instance of the application will have adifferent PID so for a match to occur, the PID of the new instance islogged at the file system filter layer.

If the PID of the application does not match the saved PID, which is thecase both with the application that bypassed the security at the filesystem filter layer (S430 c) and the application where the securityparameters were not verified (S430 b), the application fails to accessthe secure store (S490 b). The program runs (S495 b) and terminateswithout having accessed the secure store (S499 b).

If the file that the application is attempting to access is not in thesecure store, but located in a different partition, the file systemlayer check is bypassed (S460 b). The application accesses another,non-secure partition (S470 b), where the application runtime completes(S480 b) and the program terminates (S485 b).

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising”, when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below, if any, areintended to include any structure, material, or act for performing thefunction in combination with other claimed elements as specificallyclaimed. The description of the present invention has been presented forpurposes of illustration and description, but is not intended to beexhaustive or limited to the invention in the form disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the invention.The embodiments were chosen and described in order to best explain theprinciples of the invention and the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiment with various modifications as are suited to theparticular use contemplated.

Although the present invention has been described in relation toparticular embodiments thereof, many other variations and modificationswill become apparent to those skilled in the art. As such, it will bereadily evident to one of skill in the art based on the detaileddescription of the presently preferred embodiment of the system andmethod explained herein, that different embodiments can be realized.

Although the present invention has been described in relation tosecuring warranty information, one of skill in the art will recognizethat the security measures disclosed are applicable to protect access tosensitive information across different applications and industries. Theuse of the system and method is described relative to protectingwarranty information but is not limited to this application.

1. A system comprising: at least one processor; at least one memory; atleast one tangible storage device; a secure partition, the securepartition comprising a secure store and a file system filter layer, saidfile system filter layer comprising a file system filter layer memory;and instructions stored on the at least one storage device for executionby the at least one processor via the at least one memory to execute: afirst process comprising instructions for accessing the secure store,wherein the first process comprises a request including a file path tothe secure store for accessing the secure store; and a second processcomprising instructions for: assigning a process identifier (“PID”) tothe first process in response to an execution of the first process;verifying the file path exists in the secure store; causing the firstprocess to register into the file system filter layers based on theverification; causing the first process to pass security parameters tothe file system filter layer; verifying the security parameters at thefile system filter layer; saving a record of the PID in the file systemfilter layer memory, in response to verifying the security parameters;causing the first process to query the secure store; matching the PID tosaid the saved record of the PID in response to the first processquerying the secure store; and allowing, upon matching the PID, thefirst process to access the file path in the secure store.
 2. The systemof claim 1, wherein the secure partition cannot be unmounted from afront end application executable on the system.
 3. The system of claim1, wherein said secure partition cannot be modified from a front endapplication.
 4. The system of claim 1, wherein the second processcomprises instructions to cause the first process fail to register intothe file system based on an incorrect verification.
 5. The system ofclaim 1, wherein the second process comprises instructions to restrictthe first process to access the secure store based on the incorrectverification.
 6. The system of claim 1, wherein the second processcomprises instructions to restrict the first process to access thesecure store when the PID of the first process is not matched to thesaved record of the PID.
 7. The system of claim 1, wherein the securityparameters comprise a license key of a product, and wherein the systemcomprises instructions for executing: the first process to retrieve thelicense key from the product; the first process to encrypt the licensekey with a mathematical encryption algorithm; and at the file systemfilter layer, decryption of the license key based on the mathematicalencryption algorithm.
 8. The computer system of claim 7, wherein themathematical encryption algorithm is one of: SHA, MD5, CRC.
 9. A method,comprising: receiving a request to access data in a secure store of acomputing system, from a first process, the request including a filepath to the data in the secure store, wherein the first process isassociated to a process identifier (PID); executing, in response toreceiving the request, a second process for: verifying that the filepath exists in the secure store; validating security parameters receivedfrom the first processed a file system filter layer of the computingsystem; creating a saved PID in a memory resource upon validating thesecurity parameters, wherein the PID is saved by the file system filterlayer and the memory resource is accessible to the file system filterlayer; matching the saved PID to the PID associated with the firstprocess; and granting, upon matching, access to the first process forthe data at the file path in the secure store.
 10. The method of claim9, wherein the data in the secure store is indicative of warrantyinformation regarding a plurality of products, and wherein the requestis to ascertain whether one of the plurality of products is underwarranty.
 11. The method of claim 10, wherein the warranty informationcomprises at least one of a maximum usage number of the products, awarranty number, and a term of warranty.
 12. The method of claim 9,comprising decrypting the security parameters by utilizing amathematical encryption algorithm.
 13. The method of claim 12, whereinthe decrypted security parameters comprise a license key for one ofplurality of products.
 14. The method of claim 9, comprising bypassingthe validation of the security parameters if the file path is notverified to exist in the secure store.
 15. A system comprising: at leastone processor; at least one memory; program instructions executable bythe at least one processor wherein the program instructions execute: afirst process comprising a request to access a secure store of thesystem; and a second process to: assign a process identifier (PID) to afirst process in response to the first process being executed by the atleast one processor; register the first process into the file systemfilter layer; verify security parameters accessed from the first processat the file system filter layer; and allow the first process to accessthe file path in the secure store based on a validation of the PID,wherein the validation includes matching the PID to a registered PID atthe file system layer.
 16. The system of claim 15, wherein the securestore comprises warranty information indicating whether a product isunder warranty and wherein the warranty information comprises at leastone of a warranty number, a maximum usage number, and a warranty termassociated with the product.
 17. The system of claim 15, wherein thesecurity parameters comprise the encrypted license key of said product.18. The system of claim 15, wherein the request to access the securestore comprises a file path corresponding to a file.
 19. The system ofclaim 18, wherein the second process is to verify the file path to existin the secure store.
 20. The system of claim 19, wherein the secondprocess is to: perform a security check, the security check comprisingvalidation of the security parameters passed by the first process at thefile system layer, if the file path is verified to exist in the securestore, bypass the security check, if the file path is not verified toexist in the secure store.